CVE-2025-36384: IBM Db2 Privilege Escalation Vulnerability

CVE-2025-36384 Overview

CVE-2025-36384 is a privilege escalation vulnerability in IBM Db2 for Windows versions 12.1.0 through 12.1.3. The vulnerability stems from an unquoted search path element (CWE-428), which allows a local user with filesystem access to escalate their privileges to higher levels on the affected system. This type of vulnerability occurs when a service or application uses an executable path containing spaces without proper quoting, enabling attackers to place malicious executables in strategic locations that get executed with elevated privileges.

Critical Impact

Local users with filesystem access can achieve full privilege escalation, potentially gaining administrative control over the database server and underlying Windows system.

Affected Products

• IBM Db2 for Windows 12.1.0
• IBM Db2 for Windows 12.1.1 - 12.1.2
• IBM Db2 for Windows 12.1.3

Discovery Timeline

• 2026-01-30 - CVE-2025-36384 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-36384

Vulnerability Analysis

This vulnerability is classified as an Unquoted Search Path Element (CWE-428). When Windows services or scheduled tasks reference executable paths that contain spaces but are not properly enclosed in quotation marks, the operating system attempts to resolve the path by splitting it at each space character and appending .exe to each segment. This behavior creates opportunities for privilege escalation when an attacker can write to directories within the unquoted path.

For example, if a service uses an unquoted path like C:\Program Files\IBM\Db2\bin\db2service.exe, Windows will attempt to execute in the following order:

1. C:\Program.exe
2. C:\Program Files\IBM\Db2\bin\db2service.exe

If the attacker can create C:\Program.exe or place an executable in another location that takes precedence, their malicious code will execute with the privileges of the vulnerable service—typically SYSTEM-level permissions for database services.

Root Cause

The root cause of CVE-2025-36384 lies in improper path handling within IBM Db2 for Windows service configurations. When registering services or tasks that reference executables in paths containing spaces, IBM Db2 fails to enclose these paths in double quotation marks. This oversight allows the Windows path resolution algorithm to be exploited by local users who can write to strategic filesystem locations.

Attack Vector

The attack requires local access to the affected Windows system with sufficient permissions to write to one of the path segments that Windows will attempt to resolve. The attacker places a malicious executable (commonly named to match a truncated path segment like Program.exe) in a location where Windows will find and execute it before reaching the legitimate IBM Db2 executable.

Once the vulnerable service restarts—either through a system reboot, service restart, or triggered action—the malicious executable runs with the elevated privileges of the service account. This typically results in SYSTEM-level access, allowing complete compromise of the database server.

The vulnerability requires no user interaction and has low attack complexity once filesystem access is obtained. However, since it requires local access with specific filesystem permissions, remote exploitation is not directly possible without first establishing a foothold on the target system.

Detection Methods for CVE-2025-36384

Indicators of Compromise

• Unexpected executables appearing in root directories or C:\Program Files\ parent folders (e.g., C:\Program.exe, C:\Program Files.exe)
• Unusual process execution chains where IBM Db2 service accounts spawn unexpected child processes
• Modified file timestamps or new files in directories along the IBM Db2 installation path
• Windows Event Log entries showing service failures followed by successful restarts with different executable paths

Detection Strategies

• Monitor for file creation events in directories that could be exploited via unquoted path vulnerabilities (e.g., C:\, C:\Program Files\)
• Implement file integrity monitoring (FIM) on critical directories and the IBM Db2 installation path
• Use Windows Security Event ID 4688 (Process Creation) to detect executables running from unexpected locations with SYSTEM privileges
• Deploy endpoint detection solutions configured to alert on executables in uncommon locations being spawned by service accounts

Monitoring Recommendations

• Enable enhanced process tracking and command-line logging in Windows Security Audit policies
• Configure SentinelOne Singularity Platform to detect privilege escalation patterns and suspicious service behavior
• Regularly audit Windows services and scheduled tasks for unquoted path configurations using tools like wmic or PowerShell
• Monitor for lateral movement attempts following any detected privilege escalation activity

How to Mitigate CVE-2025-36384

Immediate Actions Required

• Apply the latest IBM Db2 security patch referenced in the IBM Support Advisory
• Audit all IBM Db2 service configurations for unquoted paths and manually add quotation marks where necessary
• Restrict write permissions on directories that could be exploited (particularly C:\ root and C:\Program Files\ parent directories)
• Implement application whitelisting to prevent unauthorized executables from running in sensitive directories

Patch Information

IBM has released a security update to address this vulnerability. Organizations should review and apply the patch available through the IBM Support Page. The patch addresses the unquoted search path issue by properly quoting executable paths in service configurations.

Affected versions include IBM Db2 for Windows 12.1.0 through 12.1.3. Administrators should upgrade to the patched version as soon as possible after appropriate testing in non-production environments.

Workarounds

• Manually quote service paths by modifying the Windows Registry or using sc config command to update service configurations with properly quoted paths
• Remove write permissions from potential exploit directories such as C:\ for non-administrative users
• Implement Windows Defender Application Control (WDAC) or AppLocker policies to block execution of unauthorized binaries
• Deploy network segmentation to limit the impact of any successful privilege escalation on database servers

# Configuration example - Audit for unquoted service paths on Windows
# Run in PowerShell with administrative privileges

# List all services with unquoted paths containing spaces
Get-WmiObject -Class Win32_Service | 
  Where-Object { $_.PathName -match '^\s*[^"].*\s+.*\.exe' } | 
  Select-Object Name, DisplayName, PathName, StartMode

# Alternative using wmic
wmic service get name,displayname,pathname,startmode | findstr /i "db2"